JA EN
shiichan

Cloudflare Gateway gets granular roles for policies and lists!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hi everyone, it's me, Shiichan! Today I've got a small but handy update about permissions. It's a quiet one, but if you run things as a team you'll be glad about it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Over on the Cloudflare Changelog, Cloudflare Gateway firewall policies and Zero Trust lists now support granular, resource-scoped roles. Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control.

The story so far

Until now the roles were mostly account-level, so to let someone work on Gateway you often had to hand over pretty broad access. Narrow delegation like "only edit the DNS policies, please" was awkward.

What changes

Now you can match access to the job: a network engineer can get write access to specific policies, security analysts can view all policies in read-only mode, and a list-management team can handle lists without touching policy configuration.

The nice part is that these work alongside your existing account-level roles. Members with legacy roles keep full access to all Gateway resources, so nothing breaks overnight.

Dive Deep

Here are the roles that were added:

  • Zero Trust Gateway Firewall Policies Admin (view and edit all firewall policies, including DNS, HTTP, and Network)
  • Zero Trust Gateway DNS / HTTP / Network / Egress / Resolver Policies Admin (view and edit per type)
  • Zero Trust Gateway Policies Admin / Read (edit / view all policies)
  • Zero Trust Gateway Read Only (view all Gateway resources)
  • Zero Trust DNS Locations Admin, Zero Trust Proxy Endpoints Admin
  • Zero Trust Account Lists Admin / Read (edit / view all Gateway and Access lists)

To use them, just pick these roles when you add a member or create a permission policy. You can see the full list on the resource-scoped roles reference.

Wrap-up

  • Cloudflare Gateway policies and Zero Trust lists gained fine-grained, resource-scoped roles
  • You can delegate least-privilege access by policy type or read-only
  • They work alongside existing account-level roles, and legacy roles keep full access
  • Great for teams running Zero Trust who want to tighten who can touch what!

Related posts